Liang Yao

Most of the companies have a “provisioning” process to grant, change and revoke user access. Howvere, as you described, the process could heavily rely on maual. In this case, what companies usually do to mitigate the risk?

Good summary, How about leave the laptop and other sensitive doc in the vehical?

Please make a note and we should revisit this in a few weeks when discussing Windows audit. Ask yourself “so what”?

You mentioned the Board. When dealing with cyber security risk, large organization’s board members should have someone with adequate background to understand the issue.

We will discuss Data Leakage Prevention (DLP) program during the class.

What you observed were the facts or symptoms of the issues. Ask yourself “so what” ? What’s the consequence?

It is auditors’ responsibility to make recommendations to management regarding audit findings. However, auditors should recommend “What” needs to be done not “How” actions should be developed and implemented. Said, please reminder me to elaborate this point next week.

Please bring this point to the class next week. You are absolutely right. Auditors’ role is to “independently” assessing the controls implemented by management. Auditors should neither design nor deploy any controls.

When we assessing IT risks across the enterprise, risks associated with different geographic locations could be very different and should be considered accordingly.

Good point. We will discuss the skillsets required to be a qualified IT auditor.

yes…we will discuss data leakage prevention (DLP) program in information security session. During that session, we will talk about risk associated with removable drivers and controls should be in place to mitigate such risk.

we will drill down IT risk categories soon…:)

How about financial auditors or operation auditors? Why it’s important for them to have some understanding of technology?